oroinc vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20223
3. 20236
4. 20242

Newest CVEs

• CVE-2023-48296

  OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID

  oroinc · orocommerce

  Medium4.3
• CVE-2023-45824

  OroPlatform's pinned entity creation form shows pages of other users

  oroinc · platform

  Medium4.3
• CVE-2023-32065

  OroCommerce get-totals-for-checkout API endpoint returns unwanted data

  oroinc · orocommerce

  Medium5.8
• CVE-2023-32064

  OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility

  oroinc · orocommerce

  Medium5.0
• CVE-2023-32063

  OroCRMCallBundle has incorrect call view page visibility

  oroinc · crm

  Medium5.0
• CVE-2023-32062

  OroCalendarBundle has incorrect system calendar events visibility

  oroinc · crm

  Medium5.0
• CVE-2022-41951

  OroPlatform vulnerable to path traversal during temporary file manipulations

  oroinc · platform

  High8.6
• CVE-2022-35950

  OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item

  oroinc · orocommerce

  Medium6.9
• CVE-2022-31037

  OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page

  oroinc · orocommerce

  Medium6.9
• CVE-2021-43852

  JavaScript Prototype Pollution in oro/platform

  oroinc · platform

  High8.8